<div dir="ltr"><div>> <a href="http://lists.katacontainers.io/pipermail/kata-dev/2019-September/001034.html">http://lists.katacontainers.io/pipermail/kata-dev/2019-September/001034.html</a><br></div><div><br>I didn't receive this email :p</div><div><pre style="margin-top:1.5em;margin-bottom:1.5em;padding:0px;border:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:12.0012px;line-height:1.5;font-family:"andale mono","lucida console",monospace;vertical-align:baseline;white-space:pre-wrap;color:rgb(83,83,83)">> Akihiro, is it possible for docker daemon to have a new configure option
> instead? Something like:
> "runtimes": {
> "kata": {
> "path": "kata-runtime",
> "privileged_without_host_devices": true
> }
> }
>
> Then the behavior aligns well with [3]. And admins can just add it when
> configuring docker to use kata-runtime. Then users don't need to change
> their docker commandline options. Since the option is useful to all
> docker+kata users, it makes sense to put it in the daemon config.</pre>Yes, this should be possible, and actually this is very similar to what I initially proposed (reuse runtimeArgs rather than introducing a new field): <a href="https://github.com/kata-containers/runtime/issues/1568#issuecomment-516284477">https://github.com/kata-containers/runtime/issues/1568#issuecomment-516284477</a></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">2019年9月20日(金) 19:57 Akihiro Suda <<a href="mailto:suda.kyoto@gmail.com">suda.kyoto@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">The current gVisor seems always isolating devices even with --privileged, but I agree future version of gVisor may benefit from privileged-without-host-devices option.<div><br></div><div>I'll keep my Moby PR open.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">2019年9月19日(木) 1:12 Fox, Kevin M <<a href="mailto:Kevin.Fox@pnnl.gov" target="_blank">Kevin.Fox@pnnl.gov</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Please don't take this the wrong way, as I like/use Kata. There are other isolated runtimes besides Kata though. gVisor comes to mind. I have heard of at least one other a while back not from the Kata linage. Does this dev separation work with them too? That may make it more palatable to be accepted.<br>
<br>
Thanks,<br>
Kevin<br>
________________________________________<br>
From: Akihiro Suda [<a href="mailto:akihiro.suda.cz@hco.ntt.co.jp" target="_blank">akihiro.suda.cz@hco.ntt.co.jp</a>]<br>
Sent: Tuesday, September 17, 2019 6:35 PM<br>
To: <a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>; 'Peng Tao'<br>
Cc: <a href="mailto:suda.kyoto@gmail.com" target="_blank">suda.kyoto@gmail.com</a>; 'kata-dev'<br>
Subject: Re: [kata-dev] moby PRs for running DinD with kata<br>
<br>
Hi Tao and Eric,<br>
Cc: my gmail<br>
<br>
<br>
> I agree with the sentiment that privileged shouldn't be used unless<br>
> actually necessary, which Akihirio showed isn't the case.<br>
> FWICS, [2] doesn't work with runc, and is Kata specific?<br>
<br>
[2] doesn't work with runc and is mostly specific to Kata.<br>
Anyway [1] also seems specific to Kata, and doesn't seem to have any valid usecase with runc.<br>
<br>
Regards,<br>
Akihiro Suda<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a> [mailto:<a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>]<br>
Sent: Wednesday, September 18, 2019 1:09 AM<br>
To: Peng Tao<br>
Cc: kata-dev; Akihiro Suda; Xu Wang<br>
Subject: Re: moby PRs for running DinD with kata<br>
<br>
Hey Tao,<br>
<br>
On Tue, Sep 17, 2019 at 11:42:20PM +0800, Peng Tao wrote:<br>
> Hi Kata developers/maintainers/AC members,<br>
><br>
> Since I cannot attend the AC meeting today, I want to bring to your<br>
> attention about two mody PRs([1] and [2]).<br>
<br>
FWIW, I like using the ML for these kinds of discussions, anyway, since<br>
it allows for more folks to chime in, and some digestion of the issue as<br>
well. Thanks for putting this on ML!<br>
<br>
><br>
> Akihiro Suda developed both of them as fixes for running DinD with<br>
> kata (aka, docker in kata). [1] is to provide a new docker security<br>
> option --privileged-without-host-devices, similar to the fix we had<br>
> with containerd [1]. And [2] is to simply fix the DinD entrypoint.sh<br>
> to remount sysfs in rw mode, and use a bunch of specific options to<br>
> tell docker to give proper permissions to DinD container.<br>
<br>
Thanks Akihiro.<br>
<br>
><br>
> While [2] is good enough to fix DinD with kata, I'm afraid there might<br>
> be other container images out there that require similar tweaks to<br>
> work.<br>
<br>
<br>
I agree with the sentiment that privileged shouldn't be used unless<br>
actually necessary, which Akihirio showed isn't the case.<br>
FWICS, [2] doesn't work with runc, and is Kata specific?<br>
<br>
This is probably fine for users who "know what they are doing," and<br>
are running just in Kata? Maybe there should be a DiK or DinK image?<br>
<br>
> So I'd like to ask for your opinions on this. Do you think [2]<br>
> is good enough or is it better to persuade moby maintainers to go with<br>
> [1] instead?<br>
><br>
<br>
I'm glad this is fixed already in containderd (and on its way for<br>
cri-o). I think adding a new flag would be helpful for us, but I<br>
understand this may not be acceptable from a moby maintainer pov.<br>
Changing the behavior of existing is too difficult for end-users, and<br>
i'm not sure an equivalent of [3] is feasilbe either.<br>
<br>
What do others think?<br>
<br>
-Eric<br>
<br>
<br>
<br>
> Cheers,<br>
> Tao<br>
><br>
> - [1] <a href="https://protect2.fireeye.com/url?k=82cd4273-de787dca-82cd6866-0cc47adc5fce-b70c583d0228b90b&q=1&u=https%3A%2F%2Fgithub.com%2Fmoby%2Fmoby%2Fpull%2F39702" rel="noreferrer" target="_blank">https://protect2.fireeye.com/url?k=82cd4273-de787dca-82cd6866-0cc47adc5fce-b70c583d0228b90b&q=1&u=https%3A%2F%2Fgithub.com%2Fmoby%2Fmoby%2Fpull%2F39702</a><br>
> - [2] <a href="https://protect2.fireeye.com/url?k=44cf4bd5-187a746c-44cf61c0-0cc47adc5fce-d0e67658ad4ffff0&q=1&u=https%3A%2F%2Fgithub.com%2Fdocker-library%2Fdocker%2Fpull%2F191" rel="noreferrer" target="_blank">https://protect2.fireeye.com/url?k=44cf4bd5-187a746c-44cf61c0-0cc47adc5fce-d0e67658ad4ffff0&q=1&u=https%3A%2F%2Fgithub.com%2Fdocker-library%2Fdocker%2Fpull%2F191</a><br>
> - [3] <a href="https://protect2.fireeye.com/url?k=bda7b490-e1128b29-bda79e85-0cc47adc5fce-3601f0663a93c4fe&q=1&u=https%3A%2F%2Fgithub.com%2Fcontainerd%2Fcri%2Fpull%2F1225" rel="noreferrer" target="_blank">https://protect2.fireeye.com/url?k=bda7b490-e1128b29-bda79e85-0cc47adc5fce-3601f0663a93c4fe&q=1&u=https%3A%2F%2Fgithub.com%2Fcontainerd%2Fcri%2Fpull%2F1225</a><br>
><br>
> --<br>
> Into something rich and strange.<br>
<br>
<br>
<br>
_______________________________________________<br>
kata-dev mailing list<br>
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.io</a><br>
<a href="https://protect2.fireeye.com/url?k=b10dcffa-edb8f043-b10de5ef-0cc47adc5fce-51d79a4c6c880768&q=1&u=http%3A%2F%2Flists.katacontainers.io%2Fcgi-bin%2Fmailman%2Flistinfo%2Fkata-dev" rel="noreferrer" target="_blank">https://protect2.fireeye.com/url?k=b10dcffa-edb8f043-b10de5ef-0cc47adc5fce-51d79a4c6c880768&q=1&u=http%3A%2F%2Flists.katacontainers.io%2Fcgi-bin%2Fmailman%2Flistinfo%2Fkata-dev</a><br>
</blockquote></div>
</blockquote></div>